dependency-auditor
Audit project dependencies for CVEs and licenses and plan safe upgrades. Use whenever the user asks if their packages are safe, before a release or major version bump, while chasing a CVE, or for a license review.
Target: Target not categorized. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Dependency Auditor
- Quick Start
- Supported Ecosystems
- License Classification
- Upgrade Risk Matrix
- Scripts (accurate capability claims)
- CI Integration
- Best Practices
Skill Type: POWERFUL · Category: Engineering · Domain: Dependency Management & Security Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do not call live advisory APIs; pair their findings with npm audit / pip-audit / cargo audit for current CVE coverage. Consume the outputs: scan.json findings drive which packages to pin/patch now; licenses.json conflicts go to the user as a legal-risk list; plan.json orders upgrades by risk with rollback notes. --quick-scan skips transitive deps; --security-only limits the plan to security fixes. Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit. | Language | Manifests parsed | |---|---| | JavaScript/Node | package.json, package-lock.json, yarn.lock | | Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock | | Go | go.mod, go.sum | | Rust | Cargo.toml, Cargo.lock | | Ruby | Gemfile, Gemfile.lock | | Java | pom.xml, gradle.lockfile | | PHP | composer.json, composer.lock | | C#/.NET | packages.config, project.assets.json | Permissive: MIT, Apache 2.0, BSD (2/3-clause), ISC
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- alirezarezvani/claude-skills
- Source file
- engineering/skills/dependency-auditor/SKILL.md
- Fixed revision
- 8f082544116fc0d014188e521ca40304cdfc86b0
Requirements
- Only the author’s Skill metadata is included. Read the full instructions to check dependencies, licensing and conditions of use.
A small first task
先阅读原作者说明，再决定是否在自己的 AI 工具中使用。
Instructions for your AI tool
- Claude Desktop: resource-specific guide not available yet
- Claude Code: resource-specific guide not available yet
- Cursor: resource-specific guide not available yet
- Codex: resource-specific guide not available yet
Author documentation is not live verification by this site. Without evidence, we do not mark a resource as compatible, safe or free.
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: alirezarezvani/claude-skills · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-09T14:01:46.787Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.